PSR mandatory reimbursement is the UK rule, in force since 7 October 2024, that a bank or payment firm must reimburse a customer tricked into sending a Faster Payment or CHAPS transfer to a fraudster, up to £85,000, within five business days, and may then recover half from the firm that received the money. For a claims team it means four jobs that used to be optional now run against a clock: telling the receiving bank within two hours, judging scope and gross negligence on evidence the bank must supply, having a person judge vulnerability, and chasing the other bank's share. The difficulty is that the evidence sits in five places and the decision is due in five days. Botminds' APP Fraud Reimbursement is built for that desk: agents gather and cite the evidence for each question the rules ask, and named people decide, check and sign.
This guide reads the regime as an operating model. It starts with what the Payment Systems Regulator requires, maps each requirement to a seat, and uses the PSR's own published data to size the work. Where it shows the solution, it uses the product's fictional sample bank, Corvane Bank UK, and its invented customers and staff; no figure on this page is a customer's result.
Five seats on one APP claim, before and after agents take the reading and chasing
Today
Works a queue of claims on five-day clocks, pulling payments, warnings, notes and calls from separate systems before a decision can even start.
With agents
Opens each claim with scope, caution, vulnerability and the amount already answered and cited, and spends the time on the decision itself.
Still theirs: The decision, and the written reasons the customer receives.
Today
Checks the arithmetic on a refund and rebuilds the reasoning behind a refusal from free-text notes.
With agents
Sees each payment’s outcome, every warning quoted word for word and similar decided claims beside the proposal.
Still theirs: The second signature on every release, and a full re-read of every refusal for gross negligence.
Today
Hears about a vulnerable customer only when a handler happens to notice something in the notes.
With agents
Receives every possible signal quoted from its note or call, with the confidence behind it, and speaks to the customer.
Still theirs: The judgment on material impact, which removes the excess and the caution exception.
Today
Claims the receiving firm’s half by message and reconciles what arrives against references that do not always match.
With agents
Sees each contribution claimed when the refund posts, its five-day due date, and the overdue ones grouped for chasing.
Still theirs: Approval of any payment going out to another firm, and queries from receiving firms.
Today
Answers for reimbursement, timeliness and consistency from spreadsheets assembled at month end.
With agents
Reads the month’s numbers with the spread between handlers and its traced cause.
Still theirs: The monthly return to the scheme operator, and the reimbursement policy itself.
What does PSR mandatory reimbursement require of a bank?
It requires the sending bank to decide every claim itself, quickly and in writing, and to share the cost with the receiving bank. The PSR's consolidated policy statement is blunt about who judges: "The sending PSP has the sole responsibility for determining whether a claim qualifies for reimbursement." The receiving bank supplies evidence and pays half; it does not decide.
The duties that shape a team come from Specific Requirement 1, the legal instrument that put the rules into the Faster Payments scheme, and from Pay.UK's scheme rules beneath it. The Bank of England applies substantially the same rules to CHAPS. Each duty is a piece of work with a deadline and an owner:
Each duty in the rules is a piece of work with an owner
| What the rules require | Where it comes from | Who carries it |
|---|---|---|
| Notify every receiving firm in the claim within two hours | PS25/5 para 3.14 (Faster Payments and CHAPS rules) | Intake, in practice the handler or an intake team |
| Reimburse within five business days, or stop the clock for a permitted purpose and close by the 35th | SR1 paras 5.1, 5.4 and 5.7 | Handler, with a reviewer approving any stop |
| Prove gross negligence before refusing; the burden is on the bank | Caution guidance para 1.6 | Handler proposes, reviewer re-reads |
| Assess vulnerability case by case, using the FCA’s definition | PS25/5 paras 3.49 to 3.52 | Vulnerable customer specialist |
| Give written reasons before the claim can close | SR1 para 5.9 | Handler, with the letter checked before it goes |
| Claim the receiving firm’s 50% only after the refund is paid | SR1 para 5.13 | Recoveries desk |
| Report compliance data to Pay.UK every month | PSR, Deadlines for firms | Head of fraud operations, from the claims themselves |
Two features of the list matter more than any single line. The deadlines overlap: a claim reported at nine on a Monday needs the receiving bank told before eleven, while the same handler is closing claims reported the previous week. And every duty leaves a trail someone else will read, whether Pay.UK's compliance team, the PSR, an auditor or the Financial Ombudsman Service. An operating model that meets the deadlines but cannot show its working fails the second test.
Who handles APP scam claims at a bank? Five seats on one claim
A claim passes through five seats: the handler who decides, a reviewer who checks the money and re-reads refusals, a specialist who judges vulnerability, a recoveries desk that collects the other bank's share, and a head of fraud operations who answers for all of it. Smaller firms combine seats, but separating the decision from its check is the point of the design. A refund or a refusal decided and released by one person gives an examiner nothing to test.
The seats exist because the questions differ in kind. Scope is a reading of the payment trail. Gross negligence is a judgment about a customer's conduct against warnings the bank gave. Vulnerability is a conversation. The contribution is a claim between institutions with its own clock. One person can be trained to do all four, but on a five-day clock the reading crowds out the judgment.
The handler's next five business days, laid out by the day each clock runs out
How fast must a bank tell the receiving bank about an APP claim?
Within two hours of receiving the claim. The PSR's policy statement says the scheme rules "require that a sending PSP, when receiving an APP scam claim, must notify any receiving PSPs identified in the claim within two hours." The reason is the money: the notice gives the receiving bank a chance to freeze what is left before it moves again.
Firms have met it well. In the regime's first three months, "most claims (86%) being reported by the sending firm to the receiving firm within two business hours of the consumer raising the claim." The same PSR review heard that the information shared was sometimes limited. For an operating model, that makes the two-hour notice an intake job, done the moment a claim is logged, with the payment details the receiving bank needs to act. It cannot wait for the handler to reach the claim in their queue.
What the PSR's data says about the desk's clocks
86%
of claims passed to the receiving firm within two business hours
first three months
82%
of claims closed within five business days
7 Oct 2024 to 31 Mar 2026
98%
closed within 35 business days
same period
67%
of receiving firms paid their share within the five-day limit
Oct 2024 to Jun 2025
Who decides if a customer is vulnerable?
A person who has spoken to the customer, or read enough to judge, should decide, because the finding changes the outcome. If the bank finds the customer vulnerable to the scam, it cannot apply the £100 excess or the consumer standard of caution exception. The PSR requires firms to use the FCA's definition, under which a vulnerable consumer is "someone who, due to their personal circumstances, is especially susceptible to harm", and to judge each case on its merits rather than by category.
The FCA's guidance gives the frame a specialist works in. Vulnerability is a spectrum, and the risk rises with characteristics linked to "4 key drivers": health, life events such as bereavement, resilience, and capability. The rule's test is narrower than the definition. The exception falls away where the customer was vulnerable and this had a material impact on their ability to protect themselves from the scam (SR1 para 4.2). That second limb is a judgment, not a data match.
The volume is not small. In the first three months, 14% of total APP scam claims were made by consumers with a vulnerability, about £7 million. At that rate a desk closing 1,000 claims a month will see roughly 140 that need a specialist's attention.
The specialist's queue: signals quoted, the judgment left to a person
Who signs a refusal, and who checks it?
The handler proposes or makes the decision, and a second person should re-read every refusal for gross negligence before the letter goes. The rules do not name roles, but they make refusal expensive to get wrong. The burden of proof falls on the bank alone, the PSR's guidance says it should not refuse "on the basis that a consumer received vague, non-specific written warnings", and the customer must have written reasons before the claim can close.
Refusals for lack of care are rare, which is why each one deserves two readers. Over the regime's first 18 months, 3% of claims were rejected because the customer had not taken enough care, and in the first quarter of 2026 about 1,700 claims, 2%, were rejected on that ground (PSR dashboard). A desk refusing at several times that rate is either seeing unusual fraud or applying the test unevenly, and the head of fraud operations needs to know which. The consumer standard of caution exception page sets out what a refusal file has to hold.
In Botminds' solution the agents never refuse. The Assessment agent can propose a refusal, citing each warning the customer saw word for word, but the handler decides. Refusals for gross negligence and claims over £30,000 then get a full second review by a claims quality reviewer, and every release of money is checked by a second person.
The seat nobody budgeted: the bank-to-bank desk
Every reimbursed claim creates a second claim, from the sending bank against each receiving bank, and it has its own clock. The receiving bank must pay its share within five business days of being told the amount is payable, under the Faster Payments rules the PSR cites. The sending bank can only ask once it has refunded the customer (SR1 para 5.13).
This is where the regime has struggled. Between October 2024 and June 2025, over £74 million was reimbursed to sending firms, yet only 67% of receiving firms paid within the five-day limit. Some firms told the PSR the difficulty was paying within five days rather than refusing to pay; others said contributions were hard to reconcile because receiving firms did not always use the correct reference numbers. Both are operational problems, and both land on whoever owns recoveries. The interbank mechanics, including the claims system Pay.UK provides, are on the reimbursement claims management system page.
The same desk receives claims. A bank whose customers' accounts received scam money will be asked for its share by other banks, and must check each request against its own records before paying. A recoveries seat therefore works both directions, which is why the solution requires a second person on any payment out to another firm.
How many claims can a handler close in five days?
It depends almost entirely on how long the evidence takes to gather, and that is the number to measure first. On Botminds' own estimate, working one claim by hand takes about six hours of people's time, before any waiting on the customer or the receiving bank. Over a quarter of that goes on pulling payments, warnings, notes and call recordings together.
Where six working hours on one claim go, by hand
The arithmetic that follows is simple and worth doing with your own numbers. A handler with about 35 productive hours a week has capacity for five or six claims at six hours each, if every claim arrived complete and nothing else intervened. The solution's fictional handler carries 22 open claims, which is only workable if most of the reading is done before she opens each one. Volume nationally is steady rather than falling: the PSR counted about 86,500 claims in the first quarter of 2026, around 58,400 of them reimbursable (dashboard).
Two other numbers decide staffing: how many claims need the clock stopped, and how many need a specialist. Both lengthen a claim without adding much handler time, which is why stopped claims belong in a separate column of the queue with their 35-day long stop in view. The stop the clock page covers when a pause is allowed.
What does the head of fraud operations answer for?
Three things: timeliness, outcomes and consistency, each now visible outside the bank. Sending firms report claims data to Pay.UK every month under the PSR's Compliance Data Reporting Standards; the first report covered 7 October to 30 November 2024 and was due by 6 January 2025, and every report since has covered the previous month's closed claims (PSR, Deadlines for firms). The PSR publishes the industry picture, and its supervision team has said it is monitoring outliers in the data firms submit.
Consistency is the hardest of the three to show from a spreadsheet. Two handlers given the same facts should reach the same answer, and a head of fraud operations needs to see the spread between handlers' reimbursement rates and the reason behind it. In the solution's fictional September, the gap between the highest and lowest handler was 6.1 points against a design target of 5, and the Consistency agent traced it to one pattern: an excess taken on claims where a vulnerability was later confirmed. That is the kind of finding a month-end spreadsheet hides.
Seven roles, each with what it can and cannot do
Where APP Fraud Reimbursement sits in the operating model
The solution takes the reading, the drafting and the chasing; people keep every decision, check and signature. Seven agents divide the work. The Intake agent builds the claim and notifies each receiving firm within two hours. The Assessment agent answers scope and the four requirements of the consumer standard of caution, classing each warning as bespoke or boilerplate. The Vulnerability agent finds and quotes signals for the specialist. The Clock agent counts business days and records each stop with its permitted purpose. The Consistency agent compares each proposal with similar decided claims. The Letter agent drafts the outcome letter. The Recovery agent claims each receiving firm's share once the refund posts.
What it does not do matters as much. It does not prevent the scam; detection and warnings before the money moves are the work of Botminds' APP fraud detection solution. It does not decide, refuse, stop a clock, send a letter or move money without a named person. It works alongside the systems a claim already touches, including the core banking system, the Faster Payments gateway and the industry claims exchange. The design targets are every claim decided within five business days, or by the 35th where the clock is stopped for a permitted reason, and no more than five points between handlers' reimbursement rates.
Questions to settle before you staff an APP claims desk
- Who sends the two-hour notice?
If it waits for the handler, it will be late on busy days. It belongs at intake.
- Who may stop a clock, and who approves it?
A stop needs a permitted purpose and an outstanding request; someone other than the requester should confirm both.
- Who judges vulnerability, and from what?
A trained specialist, from notes and calls, judging material impact rather than category.
- Which decisions get a second reader?
At least every refusal for gross negligence, and every release of money.
- Who owns the contributions, both ways?
Claims you make on receiving firms, and claims made on you.
- Can you show consistency?
The spread between handlers on similar claims, with its cause, before the PSR’s outlier monitoring finds it.
Questions people ask
Is APP fraud reimbursement mandatory for all UK banks?
It applies to payment firms of all kinds that provide accounts able to send or receive Faster Payments or CHAPS in the UK, including banks, building societies and e-money firms. Accounts provided by credit unions, municipal banks and national savings banks are excluded (PS25/5 para 3.6). The duty applies to payments made on or after 7 October 2024.
Does the receiving bank decide whether the customer is reimbursed?
No. The sending bank alone decides whether a claim qualifies; the receiving bank must answer requests for information in a timely and accurate manner and pay its 50% share when asked. It cannot be asked for that share until the customer has been refunded.
What is the PSR's two-hour rule?
A sending bank must notify every receiving bank named in a claim within two hours of receiving it, under the Faster Payments and CHAPS reimbursement rules. In the first three months, 86% of claims were passed on within two business hours, according to the PSR.
How often do banks report APP claims data?
Monthly. Sending firms report the previous month's closed claims to Pay.UK under reporting standard A of the PSR's Compliance Data Reporting Standards, and must tell Pay.UK when they had no in-scope claims in a period. A more detailed reporting standard B is due to start on a date still to be confirmed.
Can one person handle and approve the same APP claim?
The rules do not forbid it, but the burden of proof on refusals and the scrutiny of the Financial Ombudsman make a second reader the safer design. In Botminds' solution the handler role cannot check a release, approve a stop or review a refusal, and a reviewer cannot check a claim they decided themselves.